IAM Users

What It Is

An IAM User is an identity within an AWS account that represents a person or application needing to interact with AWS resources. Each user has a unique name within the account and can have credentials (password, access keys) to authenticate.

Why It Matters

IAM users are the foundational identity unit in AWS. Understanding how users work — and how they get permissions — is essential for both day-to-day operations and certification exams. Users alone have no permissions by default; they must be granted access explicitly.

Key Concepts

User Credentials

Credential Type	Purpose
Console password	Sign in to the AWS Management Console
Access keys (key ID + secret)	Programmatic access via CLI/SDK/API
MFA device	Additional authentication factor

Characteristics

A new user has zero permissions until policies are attached (directly or via group membership)
Users are identified by a friendly name (e.g., user-1) and an ARN (e.g., arn:aws:iam::123456789012:user/user-1)
Users can belong to multiple groups simultaneously
Users can have policies attached directly (not recommended at scale) or inherit them from groups

Each AWS account has an account-specific sign-in URL for IAM users:

https://<account-id>.signin.aws.amazon.com/console

This URL is found on the IAM Dashboard and can be customized with an account alias.

Gotchas

A brand new user has no permissions at all — not even to view their own account info
Users are global (not region-specific) — IAM is a global service
There is a default limit of 5,000 IAM users per account
Best practice: use groups to assign permissions, not direct user policy attachments

AWS Certification Notes